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DETAILED ACTION 
Claim Rejections - 35 (JSC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Hailpem et al. (6,275,937 B1) in view of Trcka (6,453,345). 

Claim 1 : Hailpem teaches that all proxies and clients in hierarchy access information 
from content servers connected to the Internet (col. 7, lines 18-22) and firewall isolated 
intranets are customized (col. 7, lines 27-29) to discourage but not eliminate the 
possibility that client computers may be potentially infected, a processor indicating a 
virus checking program such as IBM Anti Virus or Microsoft Anti-Virus (col. 1 1 , lines 39- 
55) and members of Postponable are virus checked, suggesting that anti-virus scanning 
is accessible via the network (col. 16, lines 25-37), a Request Rate Database provides 
for storage, update and retrieval of the historical information of the number of times the 
server has received requests for a particular process to be applied to a particular piece 
of data (col. 9, lines 12-22), a server which processes and caches cross-references 
URLs and requested process with a number — this database server may maintain and 
provide access to additional information (col. 9, lines 23-41), and a Dangerous Source 
Database provides for storage, update, and retrieval of historical information regarding 
which content sources have delivered virus-infected data (col. 9, lines 41-51). Hailpem 
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fails to teach a virus tracking display mode accessible by a tracking user from the virus- 
tracking server, the display mode providing real-time updates of virus information 
pertaining to the scan logs. Trcka teaches an object class libraries for allowing the user 
to select between a variety of display formats, including various graphs, lists, and tables 
for display of report data from the analysis applications (col. 18, lines 62-66). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention 
was made to modify Hailpern's collaborative server by displaying the occurrence of 
viruses in order that an individual can easily recognize a viral threat to their computer 
system. 

Claim 2: Hailpern fails to teach a tracking user from the virus-tracking server, the 
display mode provides real-time updates of virus information pertaining to the scan logs. 
Trcka teaches an object class libraries for allowing the user to select between a variety 
of display formats, including various graphs, lists, and tables for display of report data 
from the analysis applications (col. 18, lines 62-66). It would have been obvious to a 
person having ordinary skill in the art at the time of the invention was made to modify 
Hailpern's collaborative server by providing for a display of the virus-tracking information 
in association with graphs, lists, and tables. 

Claim 3: Hailpern fails to teach display modes include a plurality of web pages with 
user selectable menus to configure the virus-tracking display on the pages. Trcka 
teaches displaying a surveillance data processing module enables authorized users to 
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interactively analyze and manipulate traffic data through a powerful analysis tools. This 
includes displaying user specified types of network events, conducting pattern searches 
of selected packet data, reconstructing transaction sequences, and identifying pre- 
defined network problems (col. 13, lines 16-19). It would have been obvious to a 
person having ordinary skill in the art at the time of the invention was made to modify 
Hailpern's collaborative server by providing for web page selections to track specific 
viruses. 

Claim 4: Hailpern fails to teach a scan log contains no information relating to the direct 
identification of the client user. The automated monitor can be configured to generate 
a log file of specific types of events, such as unsuccessful logon attempts (col. 17, lines 
37-43). However, no mention is made of the direct identification of the client user. It 
would have been obvious to a person having ordinary skill in the art at the time of the 
invention was made to modify Hailpern's collaborative server by preserving the privacy 
of the client user. 

Claim 5: Hailpern fails to teach that the scan log includes the name of the virus, the 
frequency of its occurrence, and the geographic location of the infected computer. 
Trcka teaches any of a variety of known security checks can be performed on the 
packet data at this stage. Virus checking can be performed on all incoming FTP and 
HTTP files from unknown sites (col. 14, lines 60-67 and col. 15, lines 1-4). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention 
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was made to modify Hailpern's collaborative server by presenting a tracking scan log 
with virus information of interest to a client user. 

Claim 6: Hailpern fails to teach a servlet program on the virus-tracking server is used to 
receive the scan log information from the at least one anti-virus scanning server. Trcka 
teaches the report generation module includes object class libraries for allowing the 
user to select between a variety of display formats, including various graphs, lists, and 
tables for the display of report data from the analysis applications (col. 18, lines 62-67 
and col. 19, lines 1-5. It would have been obvious to a person having ordinary skill in 
the art at the time of the invention was made to modify Hailpern's collaborative server 
by allowing for the download of files to a program for anti-virus software. 

Claim 7: Hailpern fails to teach a polling program is used to regularly retrieve virus- 
tracking information from the database server and store it in a data object. Trcka 
teaches types of reports that can be generated using this application include the 
following: individual user activity; application activity; transaction activity; logons; and 
unauthorized access to restricted files and databases (col. 20, lines 13-17). These 
processes are used to track the viruses. It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by allowing for the polling of requested virus information and 
presenting it to the client user for installation of appropriate anti-virus programs in one's 
computers. 
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Claim 8: Hailpern fails to teach a common gateway interface program used to retrieve 
the data object for display by the tracking user. Trcka teaches traffic capture 
components, which run continuously in the background, to passively generate a data 
stream that represents the traffic present on the network (col. 10, lines 60-66). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention 
was made to modify Hailpern's collaborative server by reporting and logging information 
about viruses tracking for the client user in order that the client may utilize the 
information to deploy anti-virus programs. 

Claim 9: Hailpern fails to teach a Java applet running on tracking user browser is used 
to display a real-time virus-tracing map. Trcka teaches three general types of software 
components run on the controller for the purpose of processing traffic data (col. 10, lines 
59-60). It would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to modify Hailpern's collaborative server by adding a 
Java applet to decrease the CPU/modem time required to communicate with the server. 

Claim 10: Hailpern fails to teach the client user is also the tracking user. Trcka teaches 
from the screens, the user can specify such parameters as start time/date, end 
time/date, the types of events of interest. The user can specify search criteria and 
specific fields to be searched and can specify an output type of the display screen, the 
printer, or the file. (col. 20, lines 5-12) It would have been obvious to a person having 
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ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by allowing the client user to also be the user, thus allowing 
individuals to set-up web sights and protect their computer from viruses by use of the 
allowed operations. 

Claim 1 1 : Hailpern fails to teach the distributed computer network of includes the 
Internet. Trcka teaches connecting the internal network to the Internet can have 
devastating consequences (col. 1, lines 29-32). It would have been obvious to a person 
having ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by using the Internet to access live information. 

Claim 12: Hailpern teaches to discourage but not eliminate the possibility that client 
computers may be potentially infected, a processor indicating a virus checking program 
such as IBM Anti Virus or Microsoft Anti-Virus (col. 1 1 , lines 39-55) and members of 
Postponable are virus checked, suggesting that anti-virus scanning is accessible via the 
network (col. 16, lines 25-37), a Request Rate Database provides for storage, update 
and retrieval of the historical information of the number of times the server has received 
requests for a particular process to be applied to a particular piece of data (col. 9, lines 
12-22), a server which processes and caches cross-references URLs and requested 
process with a number— this database server may maintain and provide access to 
additional information (col. 9, lines 23-41). Hailpern fails to teach providing an anti-virus 
scanning program on at least one anti-virus scanning server accessible via the 
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distributed computer network, processing the scan log information into virus tracing 
information and storing it on a database server associated with the virus-tracking server, 
and retrieving the virus tracing information, and displaying a real-time trace on a 
tracking user device. Trcka teaches virus checking can be performed on all incoming 
FTP and HTTP files from unknown sites (col. 14, lines 62-67) To analyze the data, it is 
passively capture (col. 5, lines 1-4). Trcka teaches the audit application presents the 
user with a set of display screens, which allow the user to specify various settings, and 
parameters for selectively viewing and generating audit trails from the archived traffic 
data. From these screens, the user can specify such parameters as start time/date, end 
time/date, and the type of events of interest, (col. 20, lines 1-17) It would have been 
obvious to a person having ordinary skill in the art at the time of the invention was made 
to modify Hailpern's collaborative server by tracing the virus information and storing it so 
the analysis could be used to stop and prevent the virus from infecting computers. 

Claim 13: Hailpern fails to teach a tracking user from the virus-tracking server, the 
display mode provides real-time updates of virus information pertaining to the scan logs. 
Trcka teaches the Report Generation Module includes object class libraries for allowing 
the user to select between a variety of display formats, including various graphs, lists, 
and tables for the display of report data from the analysis applications (col. 18, lines 62- 
66). It would have been obvious to a person having ordinary skill in the art at the time of 
the invention was made to modify Hailpern's collaborative server by providing for a 
display of the virus-tracking information in association with geographical locations. 
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Claim 14: Hailpern fails to teach display modes include a plurality of web pages with 
user selectable menus to configure the virus-tracking display on the pages. Trcka 
teaches the Surveillance Data Processing Module is to enable authorized users to 
interactively analyze and manipulate pre-recorded traffic data through a set of powerful 
analysis tools (col. 13, lines 16-19). It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by providing for web page selections to track specific viruses. 

Claim 15: Hailpern fails to teach a scan log contains no information relating to the direct 
identification of the client user. Trcka teaches the generation of a log file of specific 
events, such as unsuccessful logon attempts (col. 17, lines 37-43). No information 
about direct identification of the client user is mentioned. It would have been obvious to 
a person having ordinary skill in the art at the time of the invention was made to modify 
Hailpern's collaborative server by preserving the privacy of the client user. 

Claim 16: Hailpern fails to teach that the scan log includes the name of the virus, the 
frequency of its occurrence, and the geographic location of the infected computer. 
Trcka teaches the report generation module includes Report Generation Module 
includes object class libraries for allowing the user to select between a variety of display 
formats, including various graphs, lists, and tables for the display of report data from the 
analysis applications (col. 18, lines 62-66). These display formats are suited for the 
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presentation of the name of the virus, frequency of occurrence, and geographical 
location. It would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to modify Hailpern's collaborative server by presenting a 
tracking scan log with virus information of interest to a client user. 

Claim 17: Hailpern fails to teach a servlet program on the virus-tracking server is used 
to receive the scan log information from the at least one anti-virus scanning server. 
Trcka teaches the report generation module includes object class libraries for allowing 
the user to select between a variety of display formats, including various graphs, lists, 
and tables for the display of report data from the analysis applications (col. 18, lines 62- 
67 and col. 19, lines 1-5). It would have been obvious to a person having ordinary skill 
in the art at the time of the invention was made to modify Hailpern's collaborative server 
by allowing for the download of files to a program for anti-virus software. 

Claim 18: Hailpern fails to teach a polling program is used to regularly retrieve virus- 
tracking information from the database server and store it in a data object. Trcka 
teaches examples of the types of reports that can be generated using this application 
include the following: individual user activity, application activity, socket activity, 
transaction activity, logons, and unauthorized accesses (col. 20, lines 13-17). This 
generation process may retrieve virus information and store it for later access. It would 
have been obvious to a person having ordinary skill in the art at the time of the invention 
was made to modify Hailpern's collaborative server by allowing for the polling of 
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requested virus information and presenting it to the client user for installation of 
appropriate anti-virus programs in one's computers. 

Claim 19: Hailpem fails to teach a common gateway interface program used to retrieve 
the data object for display by the tracking user. Trcka teaches traffic capture 
components, which run continuously in the background, to passively generate a data 
stream that represents the traffic present on the network (col. 10, lines 60-66). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention 
was made to modify Hailpern's collaborative server by reporting and logging information 
about viruses tracking for the client user in order that the client may utilize the 
information to deploy anti-virus programs. 

Claim 20: Hailpem fails to teach a Java applet running on tracking user browser is used 
to display a real-time virus-tracing map. Trcka teaches three general types of software 
components run on the controller for the purpose of processing traffic data (col. 10, lines 
59-60). It would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to modify Hailpern's collaborative server by adding a 
Java applet to decrease the CPU/modem time required to communicate with the server. 

Claim 21 : Hailpern fails to teach the client user is also the tracking user. Trcka teaches 
from the screens, the user can specify such parameters as start time/date, end 
time/date, the types of events of interest. The user can specify search criteria and 
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specific fields to be searched and can specify an output type of the display screen, the 
printer, or the file. (col. 20, lines 5-12) It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by allowing the client user to also be the user, thus allowing 
individuals to set-up web sights and protect their computer from viruses by use of the 
Tracking Center. 

Claim 22: Hailpern fails to teach the distributed computer network of includes the 
Internet. Trcka teaches connecting the internal network to the Internet can have 
devastating consequences (col. 1 , lines 29-32). It would have been obvious to a person 
having ordinary skill in the art at the time of the invention was made to modify Hailpern's 
collaborative server by using the Internet to access live information. 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Todd M Jack whose telephone number is 703-305-1027. 
The examiner can normally be reached on M-Th. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Albert Decady, can be reached 703-305-9595. The fax phone number for 
the organization where this application or proceeding is assigned is 703-746-7239. 
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Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 305-3900. 

^dd Jaci< 
August 03, 2004 
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